Score:0

Windows event log shows events in the future

cn flag
md7

One of my Windows server VMs seems to be time travelling without my permission: Screenshot of Windows Event Viewer The text reads:

time service was not able to sync the system time since 1601267 seconds (adds up to the ≈ 18 days it jumps into the future the first time) time will only be refreshed once the service was able to sync with a time server [...]

The server has since returned to "normal" time but I suspect this might be the reason some other stuff broke that night.

Has anyone an idea what could have caused this behaviour or experienced something similar?

This instance is a Windows Server 2019, virtualized in Proxmox. Other Windows Server VMs on the same Hypervisor were not affected.


Foot note

I don't have enough reputation to embed an image yet, here is a description: Screenshot of Event Viewer (in german, sorry). The selected event (details above) is the first one in the future (20.12.2022 14:25:58). Several other events (unrelated to time-service) follow on the same day, then the time jumps again to 08.01.2023 02:57:35 (Happy new year!)

cn flag
This is very common. It is usually changed through the configured time sync source, although any process can change the system time.
md7 avatar
cn flag
md7
But why should the domain controller decide to send this server specifically into the future?
cn flag
It probably is not the domain controller, unless it had the wrong time. There are several scenarios where this occurs. Running, during a restart, or a startup from a shutdown. Time changes for running guests are rare. Startup/shutdown can occur due to the guest is not in communication with AD yet, and the incorrect time sourced from the host. Either way, enabling logging on the time service would be a first start. There isn't any information otherwise. Like what was the verbose output of w32tm /query /status /verbose when the issue occurred.
yagmoth555 avatar
cn flag
@md7 If it's a VM check to be sure it's not the ESX time set, as the VM can fetch the time from the BIOS via the hypervisor too.
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.